Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 02:03
General
-
Target
2024-12-21_1d1706769cd4537e1af7051f7ef0b33a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
1d1706769cd4537e1af7051f7ef0b33a
-
SHA1
be85b5e2dffdec11f989c1da1fdc99c910e82231
-
SHA256
c09810eaa418124b042a872f3a198013c407327021478c665afa45edd069c568
-
SHA512
87337b2906d5e2ac0a29c744a10a5d2baf4672e2557942dce33bb81f14808f08932d602d35343f1fad6a2b8c7d0feeb3952d0c7f95cf2248a255071b30c181c6
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUj:E+b56utgpPF8u/7j
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_1d1706769cd4537e1af7051f7ef0b33a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_1d1706769cd4537e1af7051f7ef0b33a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nwMxiqj.exeC:\Windows\System\nwMxiqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IcvNMcB.exeC:\Windows\System\IcvNMcB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZIRLlH.exeC:\Windows\System\fZIRLlH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\diVkBuw.exeC:\Windows\System\diVkBuw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KWjphlM.exeC:\Windows\System\KWjphlM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nLoJBOu.exeC:\Windows\System\nLoJBOu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKoFIJI.exeC:\Windows\System\cKoFIJI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZxQqhJ.exeC:\Windows\System\BZxQqhJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OgZyCyp.exeC:\Windows\System\OgZyCyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzFQoAQ.exeC:\Windows\System\WzFQoAQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HCtDjdx.exeC:\Windows\System\HCtDjdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPpeflK.exeC:\Windows\System\TPpeflK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvVllia.exeC:\Windows\System\RvVllia.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xjiRLvf.exeC:\Windows\System\xjiRLvf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUfAcGV.exeC:\Windows\System\uUfAcGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LklHSVB.exeC:\Windows\System\LklHSVB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKVIKIq.exeC:\Windows\System\AKVIKIq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IASCvea.exeC:\Windows\System\IASCvea.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyzdReI.exeC:\Windows\System\iyzdReI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jBeSfov.exeC:\Windows\System\jBeSfov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AewDDlD.exeC:\Windows\System\AewDDlD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5cbf55f5599955e3808bfe7b0d19eac92
SHA1724be3323b1074fc0714f2cf9f354e85d1e97a40
SHA256fdeefa77135909caf17ac2624476888eda42ffb89c48c23ed2f3c41cbc5de3d2
SHA512eac804b9aa521e0f6054b2fec768ce66e4783aa18eb95034b4f8524d0b684ee8c0f697b1614349ac532ba31dd2a77936f077094033f8b280fec3b7422056378a
-
Filesize
5.9MB
MD58abe53e99e313037cd5de4f606113efa
SHA105244823cf60eb1e69cc4d0a36f5e41750facabe
SHA256a486ab8541fead0e3f5c0f7a7e1e486a17cfc96bd270c6e454a1273be0497b76
SHA5126b57cc35e148ff7b93be5696c3502ed0c8abbff36f71fada9d03643a13595f14cf6d1704a08b85133d0fd21de70f2de3c0b152812881bb7e053e8561cc51b128
-
Filesize
5.9MB
MD5b04c9beea210e870a35d626a4fd9d574
SHA19bb5164af983a3694f76bed209433a0f0632604f
SHA25632992f80c5596793305d5ab9d9469a0ba3f3b96e14d4ba58b09751e905edc803
SHA5128ead58fed2feabddc710e9673e37aa77c4d63514738d0947c500c2670859640efaa7f5ef7d2fb2dd0d66bc0150d7b04824022de120612d887d087ac1989ee52c
-
Filesize
5.9MB
MD52755558d4f60dbcb24f6cdbf1332b655
SHA14b2b09d70faecb96de062b23bcf34b6bbc8435ea
SHA25671bc75e883d5328cbab7da0be269e2bc0a1b739fabd7abb8b56eec613a091e30
SHA512a45adbd8b7392c5dcef05b803ae14109eed3ece284e0871df949ad3a09f07e850f0cc90e13aafbd57a70b71cf46a9c4f8dbbc5a93af7c729a1f3e2638383bf6d
-
Filesize
5.9MB
MD59fd53a3a23bf98992f1d9384dea3e6c3
SHA18d1a7fbccd671d7aacd26108823d7e166c37f6cf
SHA2568144ce7ea6a3ac2aeaafcdee74dfc55361aae5739b21522b7f7cbd5a7605b88d
SHA5125722f81bb252a72ae6b4b5b6cfe6b9aed5ea716fa7ee0beb399663d99c81bc0b2496a27364f20da8a065dc71b6f9aa4f1f18dd79486b6d94be39c3b0c1da922c
-
Filesize
5.9MB
MD5a8ba158969b589dc76c33366a5ec2281
SHA1028a7e0f35e6051584b4108ffbfd23c590f28b16
SHA25676b9598a8c585fff9ce7b2285ae8efad16fc5dfe58d5ad18899b8eb77afb597c
SHA5123877d92d9256f4b3d20fc5252277a6671595214402ab504b8c8e5b5ca5ff38ba1e2ee919421e1a012a1776464924101cdbfa14d74196441d5329411ea01ffbc7
-
Filesize
5.9MB
MD5d0374cb2d5b44931b7b236386c69dc66
SHA16dabf6897719a013a6bbe6728fb69120ff1b58fb
SHA256b16a9efa134aa3e503718ae9bf8b24ee72fa15a0532592d8e2d8d116f3968110
SHA512817f8601e0701d887d4b169ad75f0ad39b280c63ece2ef991914213672cbdb53d772c112bcbd649402960b09069325764a42a67dc60dd6ee94fda6bd430ff565
-
Filesize
5.9MB
MD58168475102660e280a60c636d8133b7a
SHA1c195d81591f683feaf67058488a6a90b6d54f5d1
SHA2569f8f6180d21158b59eb7118ea449fb2d592575ce0b5a9e98bdc21a70514ebc7f
SHA512857560adab4d8a7ca38e4325b9795ae97c1651e8e9912e2420311994029173dc476edc74f4d0319ea6303b4a11157de73361bb1157bad2b45a5b9513423139e7
-
Filesize
5.9MB
MD534632ec20c9ca8d1daa64f27fe36f823
SHA169d5bec204619619e6157ad11d095287aec1afaa
SHA256910396ddffb8f48345d2aca666a67a13da9531047768ff38ed7ad5894a262bb9
SHA512d530a0a7f58703b979bc6962fd8ed0f6a41f599ef5e8c7c84a409851f10eafeafb0033d8811038ff97c2cafd485a9527b3d596cccf7cf1cf6ae85e68d40e1e21
-
Filesize
5.9MB
MD545f5d4b4dbb26e18f9b3cf7047a39aac
SHA142eac35b63ceec896dc99c55ed4fd6524f8b6216
SHA256d8369a2f8a20b122b8c88f71c617c6f81ecb8f50d728d8ab81c529231d6384ab
SHA512753c3152720492830d99106a480c9615474fd4fe33c0e6893f278a099d0f81f38a580722448d93610423bb17be0364a04c4157750fbeeefc403b2ad6fbbc7a99
-
Filesize
5.9MB
MD5e804b05d991e05071f0c9c1c1586c052
SHA182dab8e6cab2ce9c71e8432ea2687e12ad846203
SHA256a8e89978611dc18aa399dcbbae6e7a58d88e301bbc11c03be470e30e4285f5fe
SHA512eeb772f06ecb36a3756b8168a65b958117506f77506c3703fe4d8c0cc5e3529bab9d9fdd3d52ed6973a3c48d57b86558f91a83f1a66401fa7e176793816b4ac0
-
Filesize
5.9MB
MD5f6be091bfd1afbff2c967927c550b691
SHA1569748672c7152af157c8e660a8c06d025813a7b
SHA2565aa9fc2345f2c48ebc872f48f60d293773d171b41b7e285c6b6b02c562cca17d
SHA5123b542a295b2564b921fb9038d70948f3117d361fc5b95c85b144b23d8d1ce96b266f40cc1a7b8652b273676cc32382bbbeeb9cda4922377019dfdea73b688d16
-
Filesize
5.9MB
MD5d89a86e098f6da4dcdce30ec262b7d72
SHA1bf8a80cbe6a354ebf52bdb2a3361bae69b1712d4
SHA25686cecbc477c279a61066e802271ead427b1ec3afd77f531bc4fac1452f8ae765
SHA5123afd0b5bcbb513be032679851234dc87c81dc7bcf10a79f2e7f5c0b2df2e96a1ebefa0abddfff2227247faf66379261a9cfe0fb5be28cc80db2ed8047f29b5a0
-
Filesize
5.9MB
MD5ffdaa8709fb9b919b8005858d2391095
SHA161f3121c28840d1798e2163db33c82d66e17356c
SHA2565a1e3f6154d2fe13820031ac02572b62ee68695678d07d36118ae26a3c9fac35
SHA512aa45651aee64921526b1123fb24612c9fb575ef4af70d686073d154f51adba7a6f9252f6018df580c0f3b63d379e29bd7aba027862faa0116a7bf8378225072f
-
Filesize
5.9MB
MD5008a9eeb7dadf800b8272443a1d6f3f2
SHA1baeef337ac9f4da85c439c4f7fec6f82646f1ea8
SHA25637e274e4dda3d35598bf0b59b808d03637e929982ac7645f5fc7f24ff2e20b29
SHA512f626e87b83620cc71a2830f868bf775db869846a59634b299c10d75e1890aae48a86ed070d51e50b48a1fc7e73f9c98b2797d6a089b49823a45ec586576e6edc
-
Filesize
5.9MB
MD5ed7b8132862909bca292bf057a22cb1c
SHA1d7cf97a28bbbbb4ab384fe613dfc98b6938765ef
SHA25615cc9b3554145734ae55568e4441f6070290ebfaf766b8cd1de55dffcda74134
SHA512d3057a826698bc44fff6d6ac434f4d3a21c0d5bc5415248c7f4146a9242ea3b981906a015727694432418ca0ecc7f8c5e93cb095d6b85a842c75e84ec546667d
-
Filesize
5.9MB
MD545072be52ef78fdd23d3fcd6afb16bd6
SHA1403da50993910741c37abccd863a8981d5decdc5
SHA2560bc63f735073f9e1a9deb388cf1a5aa06a2a5e5675bc83f3db405dc3099784c6
SHA51280f245ff07fef35edad59dd9267cb6a72fed0480f4376466da25f741f37ef0823501ce8ad376d3d3da76d3842c60c72ff922c6481bcc3b46f286e773de9d0ec0
-
Filesize
5.9MB
MD53f616ac1733bc741e2ca6466c924f84e
SHA1b1aafd2654010390495325f7120525a7738376b4
SHA25643e5a480db3521528c67eca5e4bf5b3f04f7a1e8cc5f0a3be7ac023f3b672bdc
SHA5127af7e752359ff25edaf303d5b89a613e2d7cd54965a0aacb370a184b2fd8fb4171e8c08ac996f48b1e5880a5d9ce6045947a0ff6c03588b05f54021daf4cf1b3
-
Filesize
5.9MB
MD52e3a274c45757abdc670cdef9f28763f
SHA1087fc1c817f9e403bc8dde8cb7f1d832c1d54c0b
SHA25627857d1b7fe26461bc69b110c9c619323a9248f3a7db75b6b7ddc57f1f6efd52
SHA5121bc33e545ac45d2f51e7abf02ccca48e0de29f9fb034e3175a03136334b2334c3d0cd45bb331d5915b7ff9f25276401cef4b40436877a471c857619e2d256fd0
-
Filesize
5.9MB
MD53869c518200aef76f339f23e5c413c93
SHA11f97cc400f306a3eefa0fc909a13be0ea3034db5
SHA256218aa38d47e09416854debcadbe0b3506369c3560192cc5c15d1d0d4f6917ed3
SHA512d6f71082aca9fb20d7f7e222525f55ed7dc9dc26ed2d88a7f3cb2265edcfd20e6095be54f53c6e1ac21f1e6fe833693e1472c1989bb73ff9edfda0dcd1f8adb0
-
Filesize
5.9MB
MD5e9600faa4b36604847f28ad638b5dccb
SHA161b3cb83db0a59dce83014c11abacbc58f31403a
SHA2564472d27fa73018939ac7364b33f85af817380d63cd5b90b5ee81a5e6c80344f1
SHA51249b5f9a6c2d9f6fd3ab1d8d1fcb5a5e01fb6cc4096eff86c1ddeff38f2a6bbfecdcb2d006e4b8db958485b310a0b81027ea455b0ddcc112419c2c6b74490e693
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB